CVE-2026-25946

Executive Summary

CVE-2026-25946 is a Server-Side Request Forgery (SSRF) vulnerability in Gitea that is exploitable when OpenID sign-in is enabled. An unauthenticated remote attacker can supply a crafted OpenID URL, causing the Gitea server to perform discovery requests against loopback or private-network HTTP services without validating the destination. The impact is limited to information disclosure and internal service interaction (CVSS 5.3), but successful exploitation can reveal internal service behavior and reach resources otherwise unreachable by the attacker.

Technical Analysis

The vulnerability resides in Gitea's OpenID sign-in flow. When OpenID authentication is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests against that URL. The core flaw is that the destination is not validated against internal network addresses before the request is issued. This is a classic SSRF pattern (CWE-918), where attacker-controlled input determines a server-side HTTP destination without adequate egress filtering, address allow-listing, or blocking of loopback and private (RFC 1918) ranges.

Because the OpenID discovery step occurs before authentication, the request is triggered pre-auth, making the attack surface reachable by any unauthenticated remote user who can reach the Gitea web interface. The server acts as a proxy: an attacker cannot normally reach internal HTTP services, but Gitea can. The attacker influences where Gitea sends its discovery request.

Per the NVD description, the observable effect is that the server "contact[s] loopback or private-network HTTP services." This exposes internal service behavior — for example, response characteristics, reachability, and potentially banner or error information — and enables interaction with resources not directly reachable by the attacker. The description does not specify whether responses are reflected back to the attacker, so the degree of response observability is not fully established. No public proof-of-concept or exploit code is available; the attack chain below is inferred from the SSRF vulnerability class.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates: network-exploitable, low attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, and no integrity or availability impact. The low confidentiality-only scoring is consistent with a blind or semi-blind SSRF that primarily leaks internal service behavior rather than granting direct data exfiltration or code execution.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the SSRF vulnerability class and the NVD description.

1. Reconnaissance / target identification: The attacker identifies a Gitea instance with OpenID sign-in enabled, typically exposed on a web port. This can be done via search engines (e.g., Shodan dorks targeting "Powered by Gitea") or by probing the login page for the OpenID sign-in option.

2. Triggering the flaw: The attacker navigates to the OpenID sign-in entry point and supplies a user-controlled OpenID URL pointing at an internal destination — for example, a loopback address or a private-range host/port. Because Gitea performs discovery requests on the supplied URL without validating the destination against internal network addresses, the server issues the outbound request on the attacker's behalf.

3. Payload / execution at the vulnerability-class level: The "payload" is the crafted OpenID URL itself. The attacker selects internal targets (loopback or private-network HTTP services) and ports to probe. Depending on how Gitea surfaces discovery results or errors (timing, error messages, redirects), the attacker may infer reachability and internal service behavior.

4. Post-exploitation impact: The attacker gains visibility into internal HTTP services and can interact with resources not directly reachable externally. Given the CVSS subscores (C:L, I:N, A:N), the primary impact is information disclosure and internal reconnaissance, potentially supporting lateral movement or chained attacks; there is no demonstrated integrity or availability impact from this CVE alone.

Impact Assessment

Business impact: An unauthenticated attacker can use a publicly reachable Gitea instance as a pivot to probe internal networks and loopback services. This can leak information about internal service behavior and expose internal-only resources to interaction. Blast radius depends on network segmentation: on flat networks or where Gitea can reach sensitive internal HTTP endpoints (admin panels, metadata services, internal APIs), exposure increases.

Mapping to CVSS subscores:

• AV:N — exploitable over the network.
• AC:L — no special conditions beyond OpenID being enabled.
• PR:N — no authentication required; the trigger occurs pre-auth.
• UI:N — no user interaction needed.
• S:U — impact confined to the vulnerable component's security scope.
• C:L — limited confidentiality impact (internal service behavior exposure).
• I:N — no integrity impact demonstrated.
• A:N — no availability impact demonstrated.

Affected systems: Gitea deployments with OpenID sign-in enabled and network reachability to internal HTTP services. No specific affected version range is available; no fixed version has been identified.

Detection Guidance

Sigma Rule

title: Potential Gitea OpenID SSRF Discovery Request to Internal Address
id: 8f2c1a44-9b7e-4c2d-a6f1-0d3e5b7c9a10
status: experimental
description: Detects Gitea OpenID sign-in requests supplying internal/private-network URLs indicative of SSRF (CVE-2026-25946).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-25946
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: gitea
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'openid'
      - 'openid_identifier'
  selection_internal:
    cs-uri-query|re:
      - '(?i)(127\.0\.0\.1|localhost|0\.0\.0\.0)'
      - '(?i)(10\.\d{1,3}\.\d{1,3}\.\d{1,3})'
      - '(?i)(192\.168\.\d{1,3}\.\d{1,3})'
      - '(?i)(172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3})'
      - '(?i)(169\.254\.\d{1,3}\.\d{1,3})'
      - '(?i)(\[::1\])'
  condition: selection_endpoint and selection_internal
fields:
  - c-ip
  - cs-uri-query
  - cs-uri-stem
falsepositives:
  - Legitimate federated identity providers hosted on private networks
level: medium
tags:
  - attack.t1190
  - cve.2026.25946

YARA Rule

rule CVE_2026_25946_Gitea_OpenID_SSRF
{
    meta:
        description = "Detects HTTP requests abusing Gitea OpenID sign-in to trigger SSRF to internal addresses (CVE-2026-25946)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-25946"
        cve = "CVE-2026-25946"

    strings:
        $openid1 = "openid_identifier=" ascii nocase
        $openid2 = "openid" ascii nocase
        $internal1 = "127.0.0.1" ascii
        $internal2 = "localhost" ascii nocase
        $internal3 = "0.0.0.0" ascii
        $internal4 = "10." ascii
        $internal5 = "192.168." ascii
        $internal6 = "172.16." ascii
        $internal7 = "169.254." ascii
        $internal8 = "[::1]" ascii

    condition:
        $openid1 and any of ($internal*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-25946 Gitea OpenID SSRF Internal Address Probe"; flow:to_server,established; http.uri; content:"openid"; nocase; http.uri; pcre:"/(127\.0\.0\.1|localhost|0\.0\.0\.0|169\.254\.|10\.[0-9]{1,3}\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/i"; reference:cve,CVE-2026-25946; classtype:web-application-attack; sid:202625946; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and
      http.request.method == "GET" and
      stringContains(url.query, "openid") and
      (
        stringContains(url.query, "127.0.0.1") or
        stringContains(url.query, "localhost") or
        stringContains(url.query, "192.168.") or
        stringContains(url.query, "10.") or
        stringContains(url.query, "169.254.")
      )
  ]

Splunk SPL Query

index=web sourcetype=gitea OR sourcetype=access_combined
| where match(uri_query, "(?i)openid")
| where match(uri_query, "(127\\.0\\.0\\.1|localhost|0\\.0\\.0\\.0|169\\.254\\.|10\\.[0-9]{1,3}\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.)")
| stats count min(_time) as firstSeen max(_time) as lastSeen by src_ip uri_query
| sort - count

Wazuh OSSEC Rule

<group name="gitea,web,ssrf,">
  <rule id="100946" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>openid</url>
    <regex type="pcre2">(?i)(127\.0\.0\.1|localhost|0\.0\.0\.0|169\.254\.|10\.[0-9]{1,3}\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)</regex>
    <description>CVE-2026-25946: Gitea OpenID sign-in request targeting internal/private address (possible SSRF).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, no affected-version range, and no workarounds are available from tracked sources.

1. Immediate mitigations:

• If OpenID sign-in is not required, disable it entirely — this removes the vulnerable code path.
• Apply network egress controls / firewall rules restricting Gitea from initiating outbound HTTP requests to loopback (127.0.0.0/8, ::1), link-local (169.254.0.0/16), and private (RFC 1918) ranges, and to cloud metadata endpoints (e.g., 169.254.169.254).
• Place Gitea behind a reverse proxy / WAF and add egress filtering for any outbound requests originating from the Gitea process.
• Segment the Gitea host so it cannot reach sensitive internal HTTP services.

2. Patch/upgrade steps:

• No patched version is currently available. Monitor the Gitea project's security advisories and release notes for a fix addressing this SSRF condition.
• When a fix is released, upgrade to the patched version promptly and re-test the OpenID sign-in flow.

3. Long-term hardening:

• Enforce egress allow-listing for server-side HTTP clients rather than relying on input validation alone.
• Require that SSRF-capable features validate resolved IP addresses against a deny-list of internal ranges after DNS resolution.
• Adopt a default-deny outbound network policy for application servers and treat user-supplied URLs as untrusted.
• Continuously monitor authentication logs and egress logs for anomalous internal-address requests from Gitea.

References

• NVD — CVE-2026-25946: https://nvd.nist.gov/vuln/detail/CVE-2026-25946
• CWE-918 Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Gitea project repository and security advisories: https://github.com/go-gitea/gitea/security

No public proof-of-concept, exploit code, or Nuclei template is available. CISA KEV: not listed. No known threat actor campaigns or exploit-in-the-wild evidence at time of writing. EPSS has not yet been scored by FIRST.org.